Spam emails with better mail merging

Office for Mere Mortals
Your beginners guide to the secrets of Microsoft Office
Invalid email address
Tips and help for Word, Excel, PowerPoint and Outlook from Microsoft Office experts.  Give it a try. You can unsubscribe at any time.  Office for Mere Mortals has been running for over 20 years, we've never, ever revealed or sold subscriber details.  Privacy policy

Beware a new spam email looks more sincere than usual and fools Outlook, thanks to some clever mail merging techniques.

Occasionally a spam email arrives which shows a better than average ability by the spammer – today we got one which fooled us for a second and certainly fooled the latest Outlook 2007 spam filter.

Normally spam messages have the same message text and subject with only the email TO address changing. Some vary the subject or body text a little but it’s easy for a human to see that its junk.

But if the spammer get hold of better data they can use mail merge tools (like those in Word) to create junk emails that integrate the data with the message in ways than make the final product look more personalized to each person.

(We’re not suggesting that spammers use Microsoft Office to send spam, they could but the merge process would be too slow for the high volume traffic spammers need. Most spammers use specialist tools which send emails at high speed and using techniques to avoid detection.)

In the case below, the spammer has obtained business information; the business name, name of the owner, physical and email addresses. With that they’ve created a message which uses those details throughout the message, combined with a better than usual command of English.

The message wasn’t detected as spam by the Microsoft Outlook 2007 junk email filter (latest update). We knew it was junk in a second but an amazing number of people are still suckered into far less plausible email scams so presumably some people will respond to the message.

A copy of the message is below (with the personal details removed and the contact email addresses obscured for obvious reasons.  Line breaks retained from the original email).

You get two choices for with messages like this:



  • Right-click, choose Junk E-mail and then ‘Add to Blocked Senders list’ or
  • Hit the delete key


From: EMELDA J. SEWARD [mailto:[email protected]]
Subject: Letter to XXXXXXXXX Attn: XXXXXXXXXX

Letter to XXXXXXXXXXXX

Contact person: XXXXXX XXXXXXX

XXXXXXXXXXXXXXXXXXXXXXXXXXXX

Attn: XXXXXXXXXX , XXXXXXXXXXXX

Re: Request for proposals for InternationalFixed Income Fund and Investment Managers
Ref: Code: XXXXXXXXX 257628SABAINVTGROUP/2008/03/28/R.S.A

SIR,

This is an official letter from SABA investment group R.S.A. SABA (herein
after ” The Bank”) is a subsidiary of SABA Limited, a registered
institution (Reg. No.: 1947/025414/06), Authorized Financial Services
Provider, Registered Credit Provider (NCRCP 6). SABA investment group is
embarking on oversea/offshore investments projects on behalf of their
reputable clients who have indicated interest in high volume capital
investment projects overseas.

We have chosen you/ your company to participate in this project by
presenting yourself as one of the prospective International Fixed Income
Fund and Investment Managers in your country. This Request for Proposal
(hereinafter “RFP”) is issued in accordance with the requirements of
Section 41-16-72(4), SA Investment Code. This RFP is not an offer to
contract but seeks the submission of proposals from interested firms and
individuals that may form the basis for negotiation of Investment
Management Agreements with one or more Fixed Income Investment Manager.

The institution reserves the right to reject any or all proposals and to
solicit additional proposals if it deems that necessary. Firms and
individuals selected to serve as Fixed Income Investment Managers shall
develop fixed income investment portfolios and make recommendations to the
Bank relating to the direction and management of the investment and
reinvestment of that portion of the Fund assets managed by the Manager and
any additions thereto. Your roles in this project shall be to receive the
investment funds, advice on possible and profitable ventures in your
country; and act as International Fixed Income Fund and Investment
Managers for a period of 20 years.

Please request details of this offer by contacting a representative at the
email address:
[email protected]
Attn: James Funcken
Tel: +27 83 999 99999
(Please take note that in the subject of your email you must quote the
Reference code for this message which is

XXXXXXXXX //257628SABAINVTGROUP/2008/03/28/R.S.A

He shall provide you comprehensive details which shall include aims,
objective and procedure of this business venture, Business
agreements/contracts, various documents about the offer, our websites,
reward/benefits, terms and conditions of this venture. It is important to
notify you that this venture is one which is of high volume in financial
terms (hundreds of millions of dollars involved) and all your services
International Fixed Income Fund and Investment Managers in your country
shall be a highly rewarding one in financial terms.

Please do not reply this email, simply write a detailed email and forward
to our representative at [email protected]

In your email ensure that you provide him comprehensive information on how to
re-establish contact with you. Provide him your valid email address,
telephone number and mobile phone number and fax number to reach you.

Thanks for taking time to read this investment proposal.

Emelda J. Seward
CEO SABA investment group R.S.A. subsidiary of SABA Limited, a registered
institution (Reg. No.: 1947/025414/06), Authorized Financial Services
Provider, Registered Credit Provider (NCRCP 6)
Reply E-mail: [email protected]

subs profile e1563205311409 - Spam emails with better mail merging
Latest news & secrets of Microsoft Office

Microsoft Office experts give you tips and help for Word, Excel, PowerPoint and Outlook.

Give it a try. You can unsubscribe at any time.  Office Watch has been running for over 20 years, we've never, ever revealed or sold subscriber details.  Privacy policy
Invalid email address